Security/Cybercrime: Are Losses Out of Control — or Over-exagerated?

“Cybercrime is bigger than the global black market in marijuana cocaine and heroin combined ($288 billion) and approaching the value of all global drug trafficking ($411 billion)”  reports Norton (a Symantec company) on a 2011 summary infographic about cybercrime.

Weysan Dun, head of Omaha’s FBI field office, said that because of cybercrime,  businesses are losing an ‘unfathomable’ amount of money and proprietary information.  Dun said that the mafia and organized crime groups are increasingly turining to cyberthievery to steal money and credit card information online to help finance their operations.   The Omaha World-Herald reports Dun as saying “The Internet is designed to allow users large amounts of freedom and anonymity, which makes companies and individuals more vulnerable to cybercrime…  It’s my belief that the current model (of the Internet) … is in the long run an unsustainable model.”

Steve Durbin, global vice president of the Information Security Forum (ISF), said that “While we’re now emerging from the economic downturn, certainly here in the U.S. at least, there has been reduced investment across the enterprise and in information security in particular.  Enterprises are now playing catch up. Cybercrime, the malspace, those guys didn’t suffer from the downturn.”

Shawn Henry, FBI executive assistant director, said that  “I believe the cyber threat is an existential one, meaning that a major cyber attack could potentially wipe out whole companies. It could shut down our electric grid or water supply.  It could cause serious damage to parts of our cities, and ultimately even kill people.”

Phyllis Schneck, a vice president at Intel’s McAfee subsidiary in Santa Clara who heads the National Cyber Forensics and Training Center against cyberattacks, said that “That is the sucking sound of all our intellectual property going to another country.  Our cyberadversaries are faster than we.”

But writing in the New York Times Opinion column, Microsoft researchers Dinei Florencio and Cormac Herley, dispute the concerns about cybercrimes.  The two report that “We have examined cybercrime from an economics standpoint and found a story at odds with the conventional wisdom. A few criminals do well, but cybercrime is a relentless, low-profit struggle for the majority…  It turns out that such widely circulated cybercrime estimates are generated using absurdly bad statistical methods, making them wholly unreliable…  Credentials and stolen credit-card numbers are offered for sale at pennies on the dollar for the simple reason that they are hard to monetize. Cybercrime billionaires are hard to locate because there aren’t any. Few people know anyone who has lost substantial money because victims are far rarer than the exaggerated estimates would imply…  The harm experienced by users rather than the (much smaller) gain achieved by hackers is the true measure of the cybercrime problem. Surveys that perpetuate the myth that cybercrime makes for easy money are harmful because they encourage hopeful, if misinformed, new entrants, who generate more harm for users than profit for themselves.”

Who’s right?  It’s unclear, but it would seem that FBI officers that need to deal with cybercrime cases on a daily basis have better first-hand knowledge of the true situation.